EUVD-2026-67078
GHSA-p68p-fq8j-3639
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Default all-interface bind with no auth gives network, low-complexity, unauthenticated access; run_command executes as the OS user beyond the MCP component, so S:C with full C/I/A impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
startServer.ts in the mcp-http-server package of UI-TARS-desktop defaulted its listen address to '::' when no host was given, so startSseAndStreamableHttpMcpServer bound the Streamable HTTP and SSE MCP transports to every interface, and its authentication middleware was optional: middlewares are applied only when a caller supplies them. The @agent-infra/mcp-server-commands and @agent-infra/mcp-server-filesystem entry points call startSseAndStreamableHttpMcpServer with a host and port alone and pass no middleware, so neither server required a credential. The commands server exposes a run_command tool that hands its caller-supplied command string to promisify(child_process.exec), so any unauthenticated client able to reach the port could run arbitrary commands as the user running the server, and the filesystem server exposed its file read and write tools on the same terms. The listen default became 127.0.0.1 in commit c2ad42e3eb9b27830db41a3e6f51ca7179d9b168; the package version stayed at 1.2.4 across that change, so the boundary is the commit rather than a release.
AnalysisAI
Unauthenticated remote command execution affects the @agent-infra MCP servers shipped with ByteDance's UI-TARS-desktop, whose shared mcp-http-server helper defaulted its bind address to '::' (all interfaces) and only enforced authentication when a caller explicitly passed middleware. Because the commands and filesystem server entry points call startSseAndStreamableHttpMcpServer with only a host and port and no middleware, any client that can reach the listening port can invoke the run_command tool (routed to child_process.exec) or the file read/write tools with no credential. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitable when a pre-commit-c2ad42e build of the @agent-infra/mcp-server-commands or mcp-server-filesystem server is launched through its default entry point, which invokes startSseAndStreamableHttpMcpServer with host and port only - leaving the host to default to '::' (all interfaces) and passing no authentication middleware - AND the listening port (e.g. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | All available signals point to genuine critical risk in exposed deployments. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker scans a network segment for exposed MCP ports and finds a UI-TARS-desktop commands server bound to all interfaces with no authentication. They connect to the /mcp Streamable HTTP endpoint, call the run_command tool with a command such as a reverse-shell one-liner, and child_process.exec runs it as the user hosting the server, granting full interactive control. … |
| Remediation | Vendor-released patch: apply the fix from GitHub PR https://github.com/bytedance/UI-TARS-desktop/pull/1918 / commit c2ad42e3eb9b27830db41a3e6f51ca7179d9b168, which changes the default bind host from '::' to 127.0.0.1 so the MCP transports listen on loopback only unless an operator deliberately overrides the host. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify and inventory all systems running ByteDance UI-TARS-desktop, document current versions and network exposure, and assess which systems are accessible from untrusted networks. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today